lab1 day1 switching questions

CCIE ROUTING & SWITCHING

Catalyst 3560

Questions

CCIE Routing and Switching Catalyst 3560 Lab Questions of 31©2008 Network Learning, Inc. All Rights reserved Unauthorized duplication is a violation of Federal Law.

Router & Switch To Switch connection

SW-1 SW-2R1

F0/0 F0/1

R2

F0/0 F0/1

R3 R3

F0/0 F0/1

R4

F0/0 F0/1

R5

F0/0 F0/1

R6

F0/0 F0/1


F0/1

F0/2

F0/3

F0/4

F0/5

F0/6

F0/19

F0/20

F0/1

F0/2

F0/3

F0/4

F0/5

F0/6

F0/19

F0/20

Task 1

Configure the first and the second switch to be in VTP domain called CCIE

Task 2

This VTP domain should be password protected using “Cisco” as the password.

Task 3

The first Catalyst switch should be configured with a hostname of Cat-1 and the second Catalyst should have a hostname of Cat-2.

Task 4

Cat-2 should NOT have the ability to create, delete or rename VLAN or VLAN information.

Task 5

Create and configure the following VLAN assignments on Cat-1 and Cat-2:

Router Interface VLAN number CAT Switches PortR1 – F0/0 12 SW1 – F0/1R2 – F0/0 12 SW1 – F0/2R3 – F0/0 34 SW1 – F0/3R4 – F0/0 34 SW1 – F0/4


Lab 1 Basic 3560 configuration I

R5 – F0/0 56 SW1 – F0/5R6 – F0/0 56 SW1 – F0/6

Task 6

Create Loopback0 interface on Cat-1, use the IP address of 1.1.1.1 /8 and ensure that this interface’s IP address is used as the preferred source for the VTP IP updater address.

Task 7

Configure a trunk between the two switches using ports F0/19 and F0/20. None of these switches should use DTP to negotiate the trunk.

Task 8

Configure the switches such that flooded traffic is restricted to the trunk links that the traffic must use to reach the destination device.

Task 9

Configure Cat-1 and Cat-2 such that only the trunk ports (F0/19 and F0/20) and the ports that routers R1 to R6 are connected to are in use, the rest of the ports should be configured in administratively down state.

Task 10

Ensure that Cat-1 is the root bridge for the VLANs 12, 34 and Cat-2 is the root bridge for VLAN 56. Do NOT use the “priority” command to accomplish this task.

Task 11


Configure Cat-1 such that the ports that the routers are connected to bypass listening and learning state. If any of these ports receive BPDU packets, they should transition into errdisable state. Use minimum number of commands to accomplish this task. This configuration should only be applied to the ports that the routers R1 - R6 are connected to.

Task 12

Configure Cat-2 such that the ports that the routers are connected to (F0/1 - F0/6) bypass listening and learning state. If any of these ports receive BPDU packets, they should loose their portfast state. This configuration should apply to existing and future ports that are configured as portfast.

Task 13

You received a request from the IT department to monitor and analyze all the packets sent and received by the host connected to port F0/14 on Cat-1; you have connected the packet analyzer to port F0/15 on the same switch. Configure the switch to accommodate this request.

Task 14

You received another request from your IT department to keep track of all the MAC addresses that are learned by Cat-2 port F0/18. The switch must use the NMS located at 192.168.1.1 /24, configure the switch to handle this request. You should use an IP address of 2.2.2.2 /8 to accomplish this task.

Task 15

On Cat-2 port F0/14 configure the amount of bandwidth utilization for broadcast traffic to 50%.

Task 16


Mac addresses learnt dynamically by these two switches should not stay in the MAC address table if they are inactive for longer than 10 minutes.

Task 17

For management purposes, assign an IP address of 10.1.1.11 /24 to Cat-1, with a default gateway of 10.1.1.2 /24.

Task 18

Configure Cat-2 such that Unicast, Broadcast and Multicast traffic is restricted to 40% on it’s port F0/17. However, when the rate of multicast traffic exceeds the set threshold, all incoming traffic (broadcast, multicast, and unicast) should be dropped until the level drops below the threshold level. DO NOT configure policing to accomplish this task.

.

Task 19

Configure routers R1 and R3 using the following IP addresses:

R1 - F0/0 = 12.1.1.1 /8 R3 - F0/0 = 34.1.1.1 /8

Configure Cat-1 to route between VLAN 12 and 34 such that these routers can ping each other. Use any Ip address on Cat-1 to accomplish this task.

Task 20

Remove the configuration from the previous step and configure Inter Vlan routing between VLANs 12 and 34. DO NOT use SVIs to accomplish this task. F0/1 interface of any router can be used to accomplish this task. Use the IP addressing from the previous task. Ensure to use an industry standard protocol for the trunk.


Task 21

Configure Cat-1 such that whenever the switch learns or removes a MAC address on its port F0/18, an SNMP notification is generated and sent to the NMS located at 192.168.1.100. Since there are many users coming and going from the network, set up a trap interval time to bundle the notification traps and reduce network traffic using the following parameters:

The traps should be generated every 30 minutes. The trap should contain a maximum of 150 entries.

Task 22

Optimize the two switches using the following policies:

Cat-1 should be configured such that its memory resources in the switch are optimized for routing.

Cat-2 should be configured to be a layer 2 switch.

Task 23

Create VLANs 30, 31 and 32 on Cat-1 and ensure that these VLANs can not traverse the trunk link between Cat-1 and Cat-2.

Task 24

Configure Cat-1’s port F0/15 and F0/16 such that when client PCs connect to these ports, they automatically become member of a given VLAN. Cat-1 should be configured to use 10.1.1.1 as the primary and 10.1.1.2 as the secondary VMPS server. Ensure that the local switch reconfirms the VLAN membership every half hour and if the VMPS can not be contacted, the local switch will retry 5 times before considering the VMPS unavailable.

Task 25

Port F0/18 on Cat-1 is connected to a Cisco 7960 IP Phone. Voice traffic that originates from the phone is tagged with a CoS of 5.


A PC is connected to the 7960 IP Phone which is generating traffic with CoS of 3. Ensure that the data traffic belongs to VLAN 3 and the Voice traffic belongs to VLAN 5. The traffic originated by the 7960 IP Phone should maintain it’s CoS value, whereas the traffic that originated from the PC connected to the 7960 IP Phone should be re-written with a CoS of 1.

Task 26

The third switch should be configured with a hostname of Cat-3 and the forth switch should be configured with a hostname of Cat-4

Task 27

Configure trunking between Cat-3 and Cat-4 using ports F0/19 and F0/20. The VTP domain name should be “CCIE”.

Task 28

Configure the following VLANs and port assignments on Cat-3 and Cat-4 for the future routers:

Router Interface VLAN number CAT Switches PortR11 – F0/0 112 SW3 – F0/1R12 – F0/0 112 SW3 – F0/2R13 – F0/0 134 SW3 – F0/3R14 – F0/0 134 SW3 – F0/4R15 – F0/0 156 SW3 – F0/5R16 – F0/0 156 SW3 – F0/6

Task 29

Ensure that VLAN 112 is configured such that it does NOT get tagged as the traffic for this VLAN traverses the trunk link/s.


Task 30

Configure Multi-instance of Spanning Tree on the switches using the follows policy:

There should be two instances of STP, instance 1 and 2 Instance 1 should handle VLANs 112 and 134 Instance 2 should handle VLAN 156 All future VLANs should use instance 0 Instance 1 should use F0/19 Instance 2 should use F0/20 Cat-3 should be the root bridge for the first instance Cat-4 should be the root bridge for the second instance The name of this configuration should be CCIE The revision number should be 1

Task 31

There is a protocol analyzer connected to F0/18 on Cat-4. You received a request to monitor and analyze all packets for port F0/16 on Cat-3. Configure the switches to accommodate this request.

Task 32

Configure ports F0/21 and F0/22 on Cat-3 and Cat-1 as trunk links using an industry standard protocol, these links should appear to STP as a single link. If one of the links fails, the traffic should use the other link without any interruption.

Task 33

Ensure that the EtherChannel created in the previous step uses destination MAC addresses to load-balance the traffic load.

Task 34


Erase the startup configuration, delete the vlan.dat and reload the switches before proceeding to the next lab.



3560-Security

Questions



SW-1 SW-2R1

F0/0 F0/1

R2

F0/0 F0/1

R3 R3

F0/0 F0/1

R4

F0/0 F0/1

R5

F0/0 F0/1

R6

F0/0 F0/1


F0/1

F0/2

F0/3

F0/4

F0/5

F0/6

F0/19

F0/20

F0/1

F0/2

F0/3

F0/4

F0/5

F0/6

F0/19

F0/20

Task 1

Configure the hostname of the four Catalyst switches as follows:

First Switch = SW-1Second Switch = SW-2Third Switch = SW-3Forth Switch = SW-4

Task 2

In order to prevent a MAC flooding attack, configure port F0/1 on SW-1 to limit the number of learned MAC addresses to one. The switch should learn this MAC address dynamically and then translate it to static; this entry should be deleted after 60 minutes of inactivity.

Task 3

In order to prevent MAC flooding, configure Cat-2 using the following policy:

Ports that routers R1 – R6 are connected should be configured such that they only allow one MAC-address to be detected, if this policy is violated, the appropriate switchport should NOT send an SNMP trap or a syslog message, but it should ignore all frames coming from the newly learned MAC address. The switch should be configured such that it learns the MAC addresses of the routers dynamically and converts them to sticky secure MAC addresses. You should use a regular and a smart port macro to accomplish this task.

Task 4


Lab 2 3560 Security

Cat-2’s ports F0/15 and F0/16 are connected to company’s web and e-mail server. These ports should be configured in VLAN 88. Ensure that these ports can’t communicate with each other. You should NOT configure Private VLANs to accomplish this task.


Task 5

Configure Cat-2 such that it prevents unknown unicast or multicast traffic from being forwarded between these two ports.

Task 6

The PCs that are connected or will be connected to Cat-1 port F0/16 should get authenticated before they are allowed access to the network. This authentication should use CSACS located at 192.168.1.2 using “cisco” as the key.

Task 7

Mac addresses learnt dynamically by Cat-1 should not stay in the MAC address table if they are inactive for longer than 10 minutes.

Task 8

Configure both of the switches such that if a password recovery is performed, the startup configuration is deleted automatically.


Task 9

There are 10 PCs connected to port F0/17 on Cat-2. Ensure that as long as one of these PCs gets authenticated successfully with the RADIUS server at 192.168.1.2, the rest of the PCs are allowed access to the network. Use “Cisco” as the key.

Task 10

Configure a static MAC address on Cat-1 for R6’s F0/0 interface in VLAN 56 such that if the switch receives frames destined to R6’s MAC address, it forwards the frames to F0/6.

Task 11

Configure Unicast Mac address filtering on Cat-1 such that the switch drops packets that have a source or destination address of 0000.1111.2222. If a packet is received in VLAN 1 with this MAC address as its source or destination, the packet should be dropped.

Task 12

Configure R1 and R2 as follows:

Configure trunking between the two switches using ports F0/19 and F0/20; use an industry standard trunking protocol.

Configure Cat-1 to protect R1 from ARP spoofing attack. Cat-1 should be configured such that it intercepts all ARP requests and responses on untrusted interface/s, this switch should then verify that each of these intercepted packets has a valid IP-to-MAC address binding before it updates it’s local ARP cache or forward the packets to the appropriate destination, in this case to R1, if the switch detects an invalid IP-to-MAC address binding, it should drop the packet.


Task 13

In order to prevent a DoS attack on Cat-1 port F0/23, the number of incoming ARP packets should be rate-limited to 10 PPS. The F0/23 interface should monitor for a high rate of ARP packets every 2 seconds.

Task 14

Configure Cat-1 port F0/1 to deny incoming AppleTalk, AppleTalk ARP, DECnet Phase IV, Ether type 6000 and Ether type 8042 traffic, this port should permit all other types of traffic.

Task 16

Configure a VLAN map to implement the following policy for VLAN 2:

Drop all IP communication between R1 and R2.Drop all UDP communication for existing and future hosts in this VLAN.Drop TCP communication only between hosts R3 and R4.Drop all IGMP packetsDrop MAC packets from hosts 0000.1111.2222 and 0000.1111.3333 Drop MAC packets with DECnet-IV or Vines-ip protocolsForward all other IP and NON-IP traffic

Task 17

Erase the startup configuration, delete the vlan.dat and reload the switches before proceeding to the next lab.


Task 1

The first switch should be configured with a hostname of SW-1 and the second switch should be configured with a hostname of SW-2

Task 2

Assign IP addressing to the interface of the routers using the following chart and ensure that these routers can ping each other:

Router Interface IP address and Subnet maskR1 F0/0 200.1.1.1 /24R2 F0/0 200.1.1.2 /24R3 F0/0 200.1.1.3 /24R4 F0/1 200.1.1.4 /24R5 F0/1 200.1.1.5 /24R6 F0/1 200.1.1.6 /24BB1 F0/0 200.1.1.10 /24

Task 3

Configure trunking between SW-1 and SW-2 using ports F0/19 and F0/20. Use an industry standard trunking protocol for this purpose.

Task 4

Configure the switches such that the ports that are not used are in administratively down state. Use minimum number of commands for this task.

Task 5


Lab 3 Private VLANs

Configure SW-1 and SW-2 to implement the following policy:

Routers R1, R2 and R5 should be able to ping and have reachability to each other. R2 and R5 should NOT have reachability to any other router in this lab.

Routers R3, R4 and R1 should be able to ping and have reachability to each other. R3 and R4 should NOT have reachability to any other router in this lab.

Routers R6 and R1 should be able to ping and have reachability to each other. R6 should NOT have reachability to any other router in this lab.

Routers BB1 and R1 should be able to ping and have reachability to each other. BB1 should NOT have reachability to any other router in this lab.

Ensure that R6 and BB1 are in the same VLAN, DO NOT use switchport protected, or ACLs to accomplish any of these tasks. You should only see 4 VLANs created in the output of the “Show vlan brief” command.

Task 6

Erase the startup config and reload the routers before proceeding to the next task.



3560-QOS

Questions



SW-1 SW-2R1

F0/0 F0/1

R2

F0/0 F0/1

R3 R3

F0/0 F0/1

R4

F0/0 F0/1

R5

F0/0 F0/1

R6

F0/0 F0/1


F0/1

F0/2

F0/3

F0/4

F0/5

F0/6

F0/19

F0/20

F0/1

F0/2

F0/3

F0/4

F0/5

F0/6

F0/19

F0/20

Task 1

Configure the hostname of the four Catalyst switches as follows:

First Switch = SW-1Second Switch = SW-2Third Switch = SW-3Forth Switch = SW-4

Task 2

Configure SW-3 based on the following Ingress QOS policy:

DSCP values of 00 – 20 should be mapped to Queue 1 threshold 2 with a WTD threshold of 50 percent.




Task 3

Configure SW-3 such that 60 percent of the buffer space is allocated to the ingress Queue 1 and 40 percent is allocated to ingress Queue 2.

Task 4


Lab 4 3560 QOS - I

SW-3 should be configured such that 35 percent of the ingress bandwidth is assigned to Queue 1 and 45 percent of the ingress bandwidth is assigned to Queue 2. The rest of the bandwidth should be allocated to traffic that needs to be expedited such as voice.

Task 5

Configure SW-4’s Egress Queues based on the following policy:

DSCP values of 00 – 07 should be mapped to Queue 1 threshold 1









Task 6

Configure the Egress buffers for port F0/14 as follows:

Queue 1 = 40, Queue 2 = 20, Queue 3 = 20 and Queue 4 = 20

Task 7

Configure F0/14 on SW-4 with the following policy:

Queue 1:Drop threshold 1 should be configured to 40 percentDrop threshold 2 should be configured to 60 percentReserved threshold of 100 percentMaximum threshold of 200 percent

Queue 2:Drop threshold 1 should be configured to 30 percentDrop threshold 2 should be configured to 70 percentReserved threshold of 100 percentMaximum threshold of 300 percent

Queue 3 and 4 should be configured to their default values

Task 8

Configure port F0/16 on SW-4 such that Queue 1 of this interface operates in shaped mode getting 12.5 percent of the bandwidth, whereas, Queues 2, 3 and 4 operate in share mode, sharing the remaining bandwidth among them.

Task 9

Limit the egress bandwidth on F0/16 to 80 percent of total bandwidth, DO NOT use any global configuration command as part of the solution, you should NOT use the “rate-limit” interface command for this task.

Task 10


Configure the Queues for interface F0/15 in shared mode such that Queue 1 receives 10 percent, Queue 2 receives 20 percent, Queue 3 receives 30 percent and Queue 4 receives 40 percent of the bandwidth.

Task 11

Configure port F0/16 of SW-4 such that Queue 1 is configured as the expedite queue, this will be used for voice traffic.

Task 12

On SW-2 port F0/14 configure the amount of bandwidth utilization for broadcast traffic to 50%.

Task 13

Configure the CoS values in incoming packets on SW-1 to the following DSCP values:

CoS DSCP0, 1, 2, 3 104, 5 206, 7 30

Task 14

Configure SW-2’s internal IP Precedence to DSCP mapping to be configured based on the following chart:

IP Precedence DSCP0 101 152 203 254 305 356 40


7 45

Task 15

Configure DSCP to DSCP mutation for port F0/23 on SW-1 as follows:

DSCP DSCP0 - 20 1021 - 30 2031 - 40 3041 - 50 4051 - 60 5061 - 63 60

Task 16

Erase the startup configuration and reload the switches before proceeding to the next lab.


Task 1

Configure the egress queues of SW-1’s F0/17 as follows:

Q1 should handle all the traffic with a CoS value of 0 and 1. Q2 should handle all the traffic with a CoS value of 2 and 3. Q3 should handle all the traffic with a CoS value of 4 Q4 should handle all the traffic with a CoS value of 5. Q1 should hold 120 packets whereas Q2, 3 and 4 should be configured to hold the

maximum number of packets in their Queues. These queues should be services with Q1, 2, 3 and 4 with 10%, 20%, 30% and

40% respectively.

Task 2

Configure SW-2 to have four egress queues one of which should be configured as expedite queue.

Task 3

Erase the startup config and reload the switches before proceeding to the next protocol.


Lab 5Supplemental 3550 QOS

lab1 day1 switching questions

Documents